stix2-patterns

What it is and what it does

stix2-patterns is a validator for STIX 2 Pattern expressions—the formal language used in cyber threat intelligence to describe observable conditions that indicate threat activity. It parses pattern syntax against an ANTLR grammar and reports whether a given pattern is well-formed. The package is maintained by the OASIS Cyber Threat Intelligence Technical Committee and can be used either as a standalone command-line tool or imported into Python applications to programmatically validate patterns.

The validator's main dependency is antlr4-python3-runtime, which provides the parser infrastructure. It supports Python 3.10 and later, with a development status of Alpha. The tool is useful for anyone building CTI systems, threat feeds, or security applications that need to ensure pattern expressions are syntactically correct before processing them downstream.

Use it for:

• Validate STIX patterns in a threat intelligence platform before storing or distributing them to ensure they are well-formed.
• Integrate pattern validation into a security tool's data pipeline to reject malformed observable conditions early.
• Build a CTI data quality checker that scans threat feeds for syntactically invalid STIX patterns.
• Test STIX pattern expressions programmatically in unit tests for threat detection rules or detection-as-code systems.
• Provide pattern syntax validation as part of a threat intelligence data ingestion workflow.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Validates the syntax of STIX 2 Pattern expressions used in cyber threat intelligence to describe observable conditions, available as both a command-line tool and Python library.

Yes, with conditions. The package fills a specific need for STIX 2 Pattern validation in CTI workflows and has no known vulnerabilities. However, the aging maintenance status (184 days since last release) and Alpha development status mean you should verify that it handles your specific pattern syntax correctly and be prepared to maintain a fork if critical bugs emerge. Suitable for production use in established CTI systems where pattern validation is a non-critical component.

Install

stix2-patterns on PyPI

pip install stix2-patterns

uv add stix2-patterns

poetry add stix2-patterns

Installing stix2-patterns

Before you install

Low install friction with a single runtime dependency (antlr4-python3-runtime). Maintenance status is aging—last release was 184 days ago—but the repository remains active and the package supports current Python versions (3.10 through 3.14).

License in practice

Licensed under BSD-3-Clause (permissive), an OASIS TC Open Repository license. Permissive terms mean you can use, modify, and distribute the package freely in commercial or private projects with minimal restrictions.

Quickstart

pip install stix2-patterns

from stix2patterns.validator import run_validator

pattern = "[file-object:hashes.md5 = '79054025255fb1a26e4bc422aef54eb4']"
errors = run_validator(pattern)

Requires Python 3.10 or later. The antlr4-python3-runtime dependency is installed automatically.

Verify before relying

• Whether the aging maintenance status (184 days since last release) affects stability or introduces unfixed bugs in pattern validation.
• Real-world accuracy and completeness of STIX 2 Pattern syntax validation against the full OASIS specification.
• How the package handles edge cases and malformed patterns in production CTI workflows.

Package facts

Evidence: stix2_patterns-2.1.2-py2.py3-none-any.whl

Tags

More Security packages